Display Filter Reference: PCAPNG File Format
Protocol field name: file-pcapng
Versions: 2.0.0 to 4.4.1
Back to Display Filter Reference
Field name | Description | Type | Versions |
---|---|---|---|
pcapng | Block | Label | 2.0.0 to 4.4.1 |
pcapng | Block Data | Label | 2.0.0 to 4.4.1 |
pcapng | Block Length | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Block Length (trailer) | Unsigned integer (32 bits) | 3.6.0 to 4.4.1 |
pcapng | Block Type | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Block Type Value | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Block Type Vendor | Boolean | 2.0.0 to 4.4.1 |
pcapng | Block length is < the length of the contents of the block | Label | 3.6.0 to 4.4.1 |
pcapng | Block length is < 12 bytes | Label | 3.6.0 to 4.4.1 |
pcapng | Block length is not a multiple of 4 | Label | 3.2.15 to 3.2.18, 3.4.7 to 4.4.1 |
pcapng | Block length is < 12 bytes | Label | 2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 3.4.16 |
pcapng | Block length in trailer differs from block length in header | Label | 3.6.0 to 4.4.1 |
pcapng | Custom Data | Byte sequence | 4.2.0 to 4.4.1 |
pcapng | Custom Option Binary | Byte sequence | 4.2.0 to 4.4.1 |
pcapng | Custom Option String | Character string | 4.2.0 to 4.4.1 |
pcapng | Private Enterprise Number (PEN) | Unsigned integer (32 bits) | 4.2.0 to 4.4.1 |
pcapng | Darwin Process ID | Unsigned integer (32 bits) | 2.4.0 to 4.0.17 |
pcapng | Darwin Process Name | Character string | 2.4.0 to 4.0.17 |
pcapng | Darwin Process UUID | Globally Unique Identifier | 2.4.0 to 4.0.17 |
pcapng | Secrets Data | Byte sequence | 3.0.0 to 4.4.1 |
pcapng | Secrets Length | Unsigned integer (32 bits) | 3.0.0 to 4.4.1 |
pcapng | Secrets Type | Unsigned integer (32 bits) | 3.0.0 to 4.4.1 |
pcapng | Link Type | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Reserved | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Snap Length | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Interface | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | The byte-order magic number is not valid | Label | 2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.4.1 |
pcapng | Invalid Option Length | Label | 2.0.0 to 4.4.1 |
pcapng | Invalid Record Length | Label | 2.0.0 to 4.4.1 |
pcapng | No Interface Description before block that requires it | Label | 2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.4.1 |
pcapng | Options | Label | 2.0.0 to 4.4.1 |
pcapng | Option | Label | 2.0.0 to 4.4.1 |
pcapng | Code | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Option Data | Label | 2.0.0 to 4.4.1 |
pcapng | Comment | Character string | 2.0.0 to 4.4.1 |
pcapng | DNS Name | Character string | 2.0.0 to 4.4.1 |
pcapng | End Time | Label | 2.0.0 to 4.4.1 |
pcapng | EUI Address | EUI64 address | 2.0.0 to 4.4.1 |
pcapng | Hardware | Character string | 2.0.0 to 4.4.1 |
pcapng | Number of Accepted by Filter Packets | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Number of Delivered to the User Packets | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Description | Character string | 2.0.0 to 4.4.1 |
pcapng | Number of Dropped Packets | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Number of Dropped Packets by OS | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | FCS Length | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
pcapng | Filter | Character string | 2.0.0 to 3.4.16 |
pcapng | Filter BPF program | Label | 3.6.0 to 4.4.1 |
pcapng | Filter string | Character string | 3.6.0 to 4.4.1 |
pcapng | Filter type | Unsigned integer (8 bits) | 3.6.0 to 4.4.1 |
pcapng | Filter data | Label | 3.6.0 to 4.4.1 |
pcapng | Hardware | Character string | 2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.4.1 |
pcapng | Name | Character string | 2.0.0 to 4.4.1 |
pcapng | OS | Character string | 2.0.0 to 4.4.1 |
pcapng | Number of Received Packets | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Speed | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Timestamp Offset | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Timestamp Resolution | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
pcapng | Base | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
pcapng | Value | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
pcapng | Timezone | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | IPv4 | IPv4 address | 2.0.0 to 4.4.1 |
pcapng | IPv4 Mask | IPv4 address | 2.0.0 to 4.4.1 |
pcapng | IPv6 | IPv6 address | 2.2.0 to 4.4.1 |
pcapng | IPv6 Mask | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
pcapng | MAC Address | Ethernet or other MAC address | 2.0.0 to 4.4.1 |
pcapng | OS | Character string | 2.0.0 to 4.4.1 |
pcapng | DPEB ID | Unsigned integer (32 bits) | 2.4.0 to 4.4.1 |
pcapng | Effective DPED ID | Unsigned integer (32 bits) | 2.4.0 to 4.4.1 |
pcapng | Darwin Flags | Unsigned integer (32 bits) | 3.4.0 to 4.4.1 |
pcapng | Nexus Channel(ch) | Boolean | 3.4.0 to 4.4.1 |
pcapng | Keep Alive(ka) | Boolean | 3.4.0 to 4.4.1 |
pcapng | New Flow(nf) | Boolean | 3.4.0 to 4.4.1 |
pcapng | ReXmit(re) | Boolean | 3.4.0 to 4.4.1 |
pcapng | Reserved | Boolean | 3.4.0 to 4.4.1 |
pcapng | Socket(so) | Boolean | 3.4.0 to 4.4.1 |
pcapng | Wake Packet(wk) | Boolean | 4.2.0 to 4.4.1 |
pcapng | Flow ID | Unsigned integer (32 bits) | 4.2.0 to 4.4.1 |
pcapng | Darwin svc | Unsigned integer (32 bits) | 2.4.0 to 4.4.1 |
pcapng | Drop Count | Unsigned integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Flags | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Direction | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | FCS Length | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Link Layer Errors | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | CRC Error | Boolean | 2.0.0 to 4.4.1 |
pcapng | Packet Too Long | Boolean | 2.0.0 to 4.4.1 |
pcapng | Packet Too Short | Boolean | 2.0.0 to 4.4.1 |
pcapng | Preamble Error | Boolean | 2.0.0 to 4.4.1 |
pcapng | Reserved | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Start Frame Delimiter Error | Boolean | 2.0.15 to 2.0.16, 2.2.9 to 2.2.17, 2.4.1 to 4.4.1 |
pcapng | Symbol Error | Boolean | 2.0.0 to 4.4.1 |
pcapng | Unaligned Frame Error | Boolean | 2.0.15 to 2.0.16, 2.2.9 to 2.2.17, 2.4.1 to 4.4.1 |
pcapng | Wrong Inter Frame Gap | Boolean | 2.0.0 to 4.4.1 |
pcapng | Reception Type | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Reserved | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Hash Algorithm | Unsigned integer (8 bits) | 2.0.0 to 4.4.1 |
pcapng | Hash Data | Byte sequence | 2.0.0 to 4.4.1 |
pcapng | Packet ID | Unsigned integer (64 bits) | 3.4.3 to 4.4.1 |
pcapng | Queue | Unsigned integer (32 bits) | 3.4.3 to 4.4.1 |
pcapng | Verdict data | Byte sequence | 3.4.3 to 4.4.1 |
pcapng | Verdict type | Unsigned integer (8 bits) | 3.4.3 to 4.4.1 |
pcapng | Start Time | Label | 2.0.0 to 4.4.1 |
pcapng | User Application | Character string | 2.0.0 to 4.4.1 |
pcapng | Length | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Option Padding | Label | 2.0.0 to 4.4.1 |
pcapng | Captured Packet Length | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Drops Count | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Interface | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Original Packet Length | Unsigned integer (32 bits) | 4.2.0 to 4.4.1 |
pcapng | Packet Data | Label | 2.0.0 to 4.4.1 |
pcapng | Packet Length | Unsigned integer (16 bits) | 2.0.0 to 4.0.17 |
pcapng | Packet Padding | Label | 2.0.0 to 4.4.1 |
pcapng | Records | Label | 2.0.0 to 4.4.1 |
pcapng | Record | Label | 2.0.0 to 4.4.1 |
pcapng | Code | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Record Data | Label | 2.0.0 to 4.4.1 |
pcapng | IPv4 | IPv4 address | 2.0.0 to 4.4.1 |
pcapng | IPv6 | IPv6 address | 2.0.0 to 4.4.1 |
pcapng | Name | Character string | 2.0.0 to 4.4.1 |
pcapng | Length | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Record Padding | Label | 2.0.0 to 4.4.1 |
pcapng | Byte Order Magic | Byte sequence | 2.0.0 to 4.4.1 |
pcapng | Section Length | Signed integer (64 bits) | 2.0.0 to 4.4.1 |
pcapng | Major Version | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Minor Version | Unsigned integer (16 bits) | 2.0.0 to 4.4.1 |
pcapng | Timestamp | Date and time | 2.0.0 to 4.4.1 |
pcapng | Timestamp (High) | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Timestamp (Low) | Unsigned integer (32 bits) | 2.0.0 to 4.4.1 |
pcapng | Expert Info | Label | 2.0.0 to 2.0.1 |